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THE PURPOSES OF WHE ACTS 


The purposes of the Freedom of Information and Protection of Privacy Act and the 
Municipal Freedom of Information and Protection of Privacy Act are: 


a) To provide a right of access to information under the control of government 
organizations in accordance with the following principles 
information should be available to the public; 
exemptions to the right of access should be limited and specific; and 


decisions on the disclosure of government information may be reviewed by the 
Information and Privacy Commissioner. 


b) To protect personal information held by government organizations and to provide 
individuals with a right of access to their own personal information. 
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COMMISSIONER'S MESSAGE 


It was in 1988 that Ontario’s Freedom of Informa- 
tion and Protection of Privacy Act, which applies to 
provincial government organizations, took effect 
— followed by the Municipal Freedom of Informa- 
tion and Protection of Privacy Act, covering local 
government organizations, in 1991. Since those 
dates, Ontario has built up substantial experience 
with the access and privacy system — a record that 
has now been reviewed by the Standing Commit- 
tee on the Legislative Assembly in two stages, as 
required by law. 

In December 1994, the Standing Committee 
tabled its report on the municipal Act, which 
complements its 1991 report on the provincial 
statute. Both reports contain numerous recommen- 
dations to amend the legislation. With these two 
in-depth examinations completed, the stage is now 
set for updating the Acts developed in the mid-’80s. 


CHANGING EXPECTATIONS 


Information technology and public expectations 
have changed significantly since the Acts were 
passed. While the information highway was then 
on the drawing board, it is now being constructed 
with remarkable speed — bringing enormous 
ramifications for both access to information and 
protection of privacy. 

The information highway promises unprece- 
dented expansion of access to information of all 
types — as long as we avoid financial “toll booths” 
that limit access to those who can afford to pay. 
The highway also holds promises of a golden age of 
privacy, if we insist on harnessing the power of 
technology — not only to collect, compile and 
disseminate personal information — but also to 
protect it. 

Freedom of information is about open govern- 
ment and the democratic imperative to hold 
government accountable to the people. Privacy is 
about the right of individuals to control how, when 
and if information about themselves is communi- 
cated to others. 


If these deeply rooted values are to continue to 
flourish in the mid-’90s and beyond, Ontario must 
revise its access and privacy legislation in light of 
experience with the existing system and in response 
to a changing environment. I urge the provincial 
government to bring forward amendments at the 
earliest opportunity. 


EXTENSION OF ACTS URGED 


In a submission to the Standing Committee, the 
Office of the Information and Privacy Commis- 
sioner (IPC) proposed a series of changes to the 

existing legislation. 

As a top priority, we called on the Ontario 
government to extend the access and privacy 
system to a wider range of public organizations — 
specifically, hospitals, universities, social service 
agencies and professional governing bodies. Access 
to their general records would make these impor- 
tant public bodies more accountable. At the same 
time, they often hold sensitive personal informa- 
tion that requires legislated privacy protection. 


BETTER CUSTOMER SERVICE 


My office is a strong advocate of routine disclosure 
and active dissemination of government informa- 
tion — practices which represent major advances 
in customer service. In our submission we sug- 
gested an amendment to encourage government 
organizations to adopt these customer-focused 
alternatives to the formal access process. 

Under routine disclosure, government organi- 
zations pre-classify specific types of records for 
automatic release upon request. The request could 
be either inside or outside the formal system. 
Active dissemination goes a step further. It means 
anticipating customer needs by releasing useful 
general records without waiting to be asked. 

Routine disclosure and active dissemination are 
also cost-effective strategies for government 
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organizations seeking to meet rising public demand 
for information in the face of limited resources. In 
most cases it will prove less expensive and labour 
intensive to release items freely to the public, than 
to search for specific records in response to ad hoc 
requests. 

Another IPC recommendation was to rewrite 
the Act in plain language. This would improve 
customer service by making the system more user- 
friendly, easier to understand and more efficient 
for all concerned. 


PROACTIVE APPROACH 


We called for several amendments to deal with the 
shift from paper records to computerized informa- 
tion systems. In the past, society has tended to wait 
for the problems linked with new technology to 
become visible — and then practice expensive and 
usually not entirely effective damage control. 
Instead, access and privacy concepts should be 
built into emerging systems as they are being 
designed. 

The amendments urged by the IPC would 
require government organizations to take such a 
proactive approach. It is crucial to guarantee that 
new technologies themselves do not pose barriers 
to access or threats to privacy. 


BLECTRONIGIACCESS 


For example, we proposed a regulation to ensure 
that, in designing electronic systems, information 
retrieval methods are selected with great care in 
order to maximize accessibility. Government 
organizations developing new systems should 
consider such factors as what information should 
be accessible, to whom, under what conditions and 
in what format. Freedom of information could 
become an empty phrase if access depends on 
technology that users cannot afford or cannot 
easily learn to operate. 

Furthermore, government information systems 
should include the capability to sever records elec- 
tronically. This feature would help keep access fees 
low by making it unnecessary to produce hard copy 
and then manually remove exempt information. 


PERSONAL INFORMATION 
IN PUBLIC REGISTERS 


I believe society has every right to demand that 
proponents of new technologies find ways to make 
them compatible with privacy values. Through 
such measures as encryption techniques, techno- 
logy itself can provide solutions not only to prevent 
the demise of privacy, which some pessimists are 
predicting, but to safeguard privacy more effec- 
tively than ever before. 

An example of a privacy challenge in the 
electronic age involves public databanks containing 
personal information — such as assessment rolls, 
the personal property security registration database, 
and land registry system. Since the privacy rules 
under the Acts do not apply to public databases, 
the personal information they hold is unprotected. 

However, in the past the paper medium on 
which records were stored provided a built-in 
check. But as these registers are transferred to 
electronic media, it grows exponentially easier to 
retrieve and manipulate the personal data they 
contain, and to use it for purposes other than those 
originally intended. For example, to find out who 
owned a piece of property, you once had to visit 
the registry office where the record was located and 
search the paper records. Now in many cases all it 
takes is pushing a few computer keys. 

I believe that the whole question of what 
personal information truly belongs on the public 
record needs to be rethought. As a minimum, we 
should place new privacy controls on electronic 
public databanks storing personal information, 
along the lines of the Public Register Privacy 
Principles enacted in New Zealand. The IPC 
submission to the Standing Committee recom- 
mended amending Ontario’s legislation to imple- 
ment such controls. 

Under the New Zealand approach, personal 
information in a public register can be accessed 
only through searches consistent with the way in 
which the register is organized. That is, the per- 
sonal information is not to be resorted or com- 
bined with personal data from another public 
register. Furthermore, the personal information 
may not be made available electronically, except to 
members of the public who wish to search the 
register. 


By adopting such principles, Ontario could 
ensure that new technology, in easing access to 
public information, also serves to reinforce rather 
than undermine our traditional privacy values. 


THESEND:OF HISTORY? 


Let us remember that freedom of information is 
not only about access today, but tomorrow. In- 
creasingly, records of government activity are 
stored in computerized systems that have a short 
life span. Not only are the electronic storage media 
themselves more fragile than paper, but application 
software, operating systems and hardware are 
continually being superseded by new products. 
These realities pose unprecedented challenges for 
archivists, historians and everyone interested in 
conserving our past. 

Can we hope to preserve indefinitely the array 
of computer programs that generate digital docu- 
ments, as well as the system software to run those 
programs? And if we can, what about hardware? 
For how long will we be able to maintain and 
repair the equipment needed to run antiquated 
systems and applications? Are emulator programs 
that mimic the performance of hardware a poten- 
tial solution? And who is responsible for answering 
these questions? 

Unless we begin taking action on these issues 
soon, the historical records we pass on to the next 
generation will for all practical purposes be lost. It 
would be the ultimate irony if the “information 
age” turned out to be one of the most poorly 
documented periods in human history, simply 
because the chronicle of our own era became 
irretrievable. 


ACCESS AND PRIVACY 
BECOMING INGRAINED 


While the IPC submission to the Standing Com- 
mittee focused on opportunities for positive 
change, we emphasized that the basic framework of 
the legislation is structurally sound. Substantial 
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progress has been achieved under the Acts. To a 
significant extent, access to information and 
protection of privacy have become an integral part 
of day-to-day operations for both provincial and 
municipal government organizations. 

This trend is reflected in combined provincial 
and municipal statistics showing that in 1994 about 
half of access requests led to the release of all infor- 
mation sought, while another quarter led to partial 
disclosure. Requests themselves increased 15 per 
cent over 1993 to reach an all-time high of 22 750. 


PRODUCTIVITY INCREASES 


Nevertheless, I believe the existence of the IPC as 
an independent body is a pivotal feature of the 
system that sustains access and privacy rights. I 
want to take this occasion to acknowledge the 
Legislative Assembly’s continued support for the 
mandate and activities of this office. 

We at the IPC in turn recognize our responsi- 
bility to deliver value for the public funds entrusted 
to us. In 1994, the total number of appeals filed 
from denial of access to information rose sharply 
— by 29 per cent over the previous year. In re- 
sponse to the increased volume, we closed four per 
cent more appeals and issued 11 per cent more 
orders. 

In addition, we have been steadily reducing the 
length of time it takes to process appeals. The 
average time to close an appeal continued to 
decline, falling to 3.6 months this year, compared 
with 5.4 months last year and 6.5 months the year 
before. Eighty-two per cent of appeals were com- 
pleted in five months in 1994, compared with 66 
per cent in 1993 and 56 per cent in 1992. We are 
on target toward the goal outlined in our strategic 
plan of processing 95 per cent of appeals within 
four months by 1996. 

On the privacy side, in 1994 we completed 
more than 200 formal investigations and resolved 
almost 300 oral complaints. The average time to 
complete an investigation this year and last 
dropped to below two months, compared with 
nearly six months in 1992. 
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COMMITMENT THE KEY 


We have a solid strategic plan in place to continue 
to improve our performance. But more important 
than a plan is the people who make it work. I 
extend my thanks to each staff member at the IPC 
whose dedication and creativity have been the true 
source of all we have achieved in the past year. 

I also want to recognize the skill and commit- 
ment of the Information and Privacy Co- 
ordinators in government organizations, who are 
on the front lines making access and privacy 
happen provincially and locally. 

Finally, staff of Management Board Secretariat 
play an invaluable role in providing training and 
expert advice to government organizations on the 
day-to-day application of the legislation. This 
centralized resource encourages a consistent 
approach across government and contributes 
immensely to the effective operation of the access 
and privacy system. 

We at the IPC look forward to the continued 
co-operation of our colleagues in provincial and 
municipal organizations to promote open govern- 
ment and to champion privacy on behalf of the 
people of Ontario. 


Tom Wright 
Information and Privacy Commissioner 


THE IPC: MANDATE AND ROLES 


The Information and Privacy Commissioner is 
appointed under the Freedom of Information and 
Protection of Privacy Act (the provincial Act) and 
the Municipal Freedom of Information and Protec- 
tion of Privacy Act (the municipal Act). Together, 
these two acts establish a system for guaranteeing 
public access to government information, with 
limited exemptions; and for protecting personal 
information held by government organizations at 
both the provincial and municipal levels. 

The provincial Act applies to all provincial 
ministries and most provincial agencies, boards and 
commissions, as well as to colleges of applied arts 
and technology and district health councils. The 
municipal Act covers local government organiza- 
tions, such as municipalities; public library, health 
and school boards; and public utilities, transit and 
police commissions. 

Ontario combines the right to access with the 
right to privacy in a single legislative system. Access 
refers mainly to information about what govern- 
ment organizations do, as reflected in administra- 
tive, operational and policy-related records. Access 
to such general records can be equated with open 
government. 

Privacy, on the other hand, concerns informa- 
tion about identifiable individuals. The Acts estab- 
lish rules about how government organizations 
may collect and use personal data. In addition, 
individuals have the right to see their own personal 
information held by government organizations and 
are entitled to request correction of this informa- 
tion. 

The mandate of the IPC is to provide an 
independent review of government decisions and 
practices concerning access and privacy. To safe- 


guard the rights established under the Acts, the 
IPC: 


* resolves appeals when government organizations 
refuse access to requested information; 


* investigates privacy complaints about govern- 
ment-held information; 


* ensures that government organizations comply 
with the Acts; 


* conducts research on access and privacy issues 
and provides advice on proposed government 
legislation and programs; and 


* educates the public about Ontario’s access and 
privacy laws. 


The Information and Privacy Commissioner 
reports to the Legislative Assembly of Ontario. The 
Commissioner is therefore independent of the 
government of the day and in a position to carry 
out duties even-handedly. The present Commis- 
sioner was appointed in 1991 for a five-year term 
on the recommendation of an all-party committee 
of the legislature, following an open, competitive 
selection process. 

In line with the legislation, the Commissioner 
has delegated some of his decision-making powers 
to his staff. The Assistant Commissioner (Access) 
and six Inquiry Officers have authority to issue 
orders resolving appeals. And the Assistant 
Commissioner (Privacy) investigates privacy 
complaints, reviews government practices, approves 
applications for indirect collection of personal 
information and comments on any computer 
matches proposed by the provincial government. 
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INFORMATION REQUESTS ACROSS GOVERNMENT: 1994 TOTALS 


Government organizations, both provincial and 
municipal, file a yearly report with the IPC on 
their activities under the Acts. These reports in- 
clude data on the requests received for general 
records, personal information and correction of 
information, as well as on the organization’s 
response to these requests. By compiling these 
reports, the IPC gains a useful picture of compli- 
ance with the Acts. 


BECORD LEVELS 


In all, provincial government organizations re- 
ceived 12 512 requests for access to information in 
1994 — the highest annual total since the provin- 
cial Act took effect. Municipal government organi- 
zations reporting for 1994 received a total of 

10 238 requests, likewise the highest volume ever 
under the municipal Act. 

Requests for access to general records outnum- 
bered requests for access to personal information 
by about three to one, in both provincial and 
municipal organizations. This was consistent with 
previous trends: in every year under either Act, 
requests for general records have exceeded those for 
personal information. 

Also in line with previous trends, both provin- 
cial and municipal organizations answered the vast 
majority of requests received in 1994 by the end of 
the year. Only nine per cent of requests were 
carried over to 1995. 


REQUEST LEADERS 


The Ministry of Finance again reported the highest 
number of requests under the provincial Act, 
followed by the Ministry of the Solicitor General 
and Correctional Services, the Ministry of Com- 
munity and Social Services and the Ministry of 
Labour. Together, these four Ministries accounted 
for 50 per cent of all provincial requests. 


Under the municipal Act, municipal corpora- 
tions (including municipal governments) received 
44 per cent of total requests. Police services boards 
were next with 36 per cent, followed by public 
utilities with nine per cent and school boards with 
five per cent. 


Requests Received and Completed — 1994 
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PROMPT RESPONSES 


Provincial government organizations have replied 
to the majority of requests within 30 days in all 
seven years of operation of the Act. Fifty-one per 
cent of provincial requests were answered within 
30 days in 1994 — the same proportion as in 
1993. Eighty-two per cent of 1994 requests were 
completed within 60 days, while only five per cent 
took more than 120 days. 

Municipal government organizations responded 
to a sizable majority of requests — 90 per cent — 
within 30 days in 1994. This was the fourth 
consecutive year at virtually the same high level. 
Ninety-six per cent of municipal requests in 1994 
were answered within 60 days, and only one per 
cent took more than 120 days to complete. 
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FAVOURABLE OUTCOMES 


As to outcomes, 45 per cent of provincial requests 
completed in 1994 led to the release of all informa- 
tion sought. For municipal requests, this climbed 
to 55 per cent leading to full disclosure. In only 
about one in eight cases was no information 
released. 

Under the exemption provisions of the Acts, 
government organizations can, and in some cases 
must, refuse to disclose requested information. 
Following the pattern of the past several years, in 
1994 both provincial and municipal organizations 
cited personal privacy and personal information 
exemptions most frequently. 


Outcome of Provincial Requests — 1990-94 
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Boo D 1901 
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Outcome of Municipal Requests — 1991-94 


All Disclosed Nothing Withdrawn/ 
Disclosed in Part Disclosed Abandoned 
| RES 1994 


Provincial Exemptions Used 
General Records — 1994 


Section 13 — Advice to 
Government 221 (9.1%) 


Section 22 — Information 


Other — 1034 (42.5% 
( ©] soon to be published 232 (9.5%) 


Section 21 — Personal 
Privacy 948 (38.9%) 


Municipal Exemptions Used 
General Records — 1994 


Section 11 — Economic/Other 
Interests 147 (5.4%) 


Section 14 — Personal = 9 
Privacy 1333 (49.1%) GUNS es) 
Section 8 — Law 

Enforcement 627 (23.1%) 


Provincial Exemptions Used 
Personal Information — 1994 


Other — 133 (13.3%) 


Section 49 — Personal 
Information 454 (45.4%) 


Section 14 — Law 
. Enforcement 172 (17.2%) 


Section 17 — Third Party 
Information 241 (24.1%) 


Municipal Exemptions Used 
Personal Information — 1994 


Section 11 — Economic/ 
Other Interests 71 (4.4%) 


Section 38 — Personal a 
Information 868 (53.5%) SUNS BEE (ea) 
Section 8 — Law 

Enforcement 401 (24.7%) 


CORRECTIONS SOUGHT 


Under the legislation individuals have the right to 
request correction of their personal information 
held by government. This year provincial organiza- 
tions received 12 correction requests and refused 
nine of them. Municipal organizations received 
397 correction requests — more than four times as 
many as last year — and refused only 17 of them. 
The tendency for provincial organizations to refuse 
correction requests and municipal organizations to 
grant them has been observed in prior years. 

When correction is refused, the requester may 
attach a statement of disagreement to the record, 
outlining why the information is felt to be incor- 
rect. This year seven provincial and 21 municipal 
statements of disagreement were filed. 


INFORMATION REQUESTS ACROSS GOVERNMENT: 1994 TOTALS 


ACCESS FEES 


The legislation permits government organizations 
to charge fees for providing access to information 
under certain conditions. A fee estimate must be 
provided before filling the request where the 
expected charge is over $25. Organizations have 
discretion to waive payment where it seems fair 
and equitable to do so after weighing several 
specific factors. In addition, people cannot be 
required to pay fees for access to their own personal 
information. 

As in earlier years, provincial organizations most 
often cited reproduction of material as the reason 
for collecting fees in 1994. Reproduction costs 
were mentioned in 36 per cent of cases where fees 
were collected, followed by preparation costs in 34 
per cent and shipping costs in 27 per cent. Muni- 
cipal organizations cited reproduction costs in 41 
per cent of cases where fees were collected, prepara- 
tion in 20 per cent and shipping in 19 per cent. 


Collected in Full 
Waived in Part 


Total Fees Collected (dollars) 
Total Fees Waived (dollars) 


_ Cases in Which Fees were Estimated 
General Records — 1994 _ 


88.7% 
- 10.9% 
Waived in Full 0.4% 


Provincial Municipal 
2642 70.6% 2167 
325 0.5% 14 
13 28.9% 887 
$154,955.05 $69,617.45 
$18,643.84 $11,253.78 


10 


RESOLVING APPEALS 


If people who request information are not satisfied 
with a government organization’s response, they 
can appeal to the IPC. Appeals can be filed con- 
cerning a refusal to grant access to general records 
or personal information, a refusal to correct per- 
sonal information, the imposition of fees, or other 
aspects of the handling of a request. 

When an appeal is filed, the IPC makes a con- 
certed effort to mediate the case by working closely 
with the parties to find common ground. Media- 
tion is successful in the majority of appeals. If the 
issues are not settled within a reasonable time 
period, the IPC conducts an inquiry and issues a 
binding order to resolve the case. 


Productivity Continues Upswing 


The efficient processing of appeals ranks as one of 
the IPC’s top priorities. The IPC resolved four per 
cent more appeals this year than last. 

We also processed appeals faster. In 1994, 82 
per cent of appeals were closed within five months 
of receipt, compared with 66 per cent closed within 
five months in 1993 and 56 per cent in 1992. The 
average time to close an appeal continued to 
decline, falling to 3.6 months this year from 5.4 
months last year and 6.5 months the year before.’ 

During the year the IPC reorganized the 
appeals staff to raise the number of decision- 
makers with authority to decide appeals from six to 
seven. This increased capacity to conduct inquiries 
and produce orders expeditiously. Partially due to 
this change, we issued 11 per cent more orders in 


1994 than in 1993. 


INNOVATION PAYS OFF 


1994 was the second year of the Innovation Pilot 
Project, designed to simplify appeal procedures and 


improve customer service. Fourteen municipal and 
provincial government organizations participated 
in this initiative, with a special IPC Innovation 
Team handling all appeals involving these institu- 
tions. 

The project sets more structured timeframes 
for various stages in the appeal process. For exam- 
ple, an inquiry automatically commences if an 
appeal has not been resolved though mediation 
within two and a half months. This deadline often 
helps focus mediation efforts, which of course may 
continue after a notice of inquiry has been issued. 
The project has also experimented with oral 
representations as an alternative to written repre- 
sentations. 

Using these new procedures, the Innovation 
Team resolved 92 per cent of its cases within five 
months, and 82 per cent within four months. The 
project results indicate that the IPC’s strategic 
objective of processing 95 per cent of appeals 
within four months is within reach, and that a 
more structured and predictable approach furthers 
this objective. 


Appeals: Statistical Overview 


In all, 1540 appeals’ were made to the IPC in 
1994 — up 29 per cent from the previous year. 
Slightly more than half the total were filed under 
the provincial Act. Since 1993, provincial appeals 
have increased 29 per cent, and municipal appeals 
30 per cent. 

Eighty-five per cent of provincial appeals 
concerned ministries rather than agencies. The 
largest share of municipal appeals — 43 per cent 
— involved municipal corporations, followed by 
police services boards and boards of education. 
These patterns were similar to those observed in 
prior years. 


' The corresponding median time to close an appeal was 2.5 months in 1994, 3.8 months in 1993 and 4.7 months in 1992. 


? The statistics cited in this annual report refer to active appeals aes unless otherwise indicated. In 1991, the IPC established a policy limiting the number of 
appeals, from any one source, worked on at one time. This policy was necessary to deal with bulk use of the appeal process. Active appeals are actively worked on by 


the IPC during the year. The remaining appeals are classified as inactive. 


Appeals Received — 1988-94 
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* An additional 741 inactive appeals were received during 1991 
** An additional 129 inactive appeals were received during 1992 
*** An additional 28 inactive appeals were received during 1993 


Although the Acts do not require people who 
file appeals to provide information about them- 
selves, the IPC tries to identify categories of appel- 
lants. This is a subjective exercise and the resulting 
information should be viewed accordingly. As in 
previous years, the figures indicate that the prime 
user of the appeal system is the general public, 
rather than businesses, news media or other kinds 


RESOLVING APPEALS 


Types of Requesters Involved in Appeals — 1994 
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The IPC closed a total of 1471 appeals during 
1994 — a four per cent increase over 1993. Fifty- 
one per cent of the appeals resolved this year were 
filed under the provincial Act, while the remaining 
49 per cent fell under the municipal Act. We closed 
13 per cent more municipal appeals this year than 
last, while provincial appeals closed were down by 
two per cent. 


of organizations. 
Appeals Received by Issue — 1994 
Types of Appeals Provincial Municipal Total 

Request for general records 219 26.9% 228 31.5% 447 29.0% 
Request for personal information 89 10.9% 48 6.6% 197 8.9% 
Request for general records/ 

personal information 426 52.2% 353 48.7% 779 50.6% 
Request for correction of 

personal information 4 0.5% 5) 0.7% 9 0.6% 
Time extension 6 0.7% 16 2.2% 22 1.4% 
Fees 42 5.2% 64 8.8% 106 6.9% 
Third Party 29 3.6% We 1.5% 40 2.6% 
Total 815 100.0% 725 100.0% 1540 100.0% 
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Of the cases closed this year, the IPC resolved 
32 per cent by issuing an order, compared with 30 
per cent by order in 1993. Orders were almost 
equally frequent in provincial and municipal 
appeals, with 33 per cent of provincial and 31 per 
cent of municipal appeals closed by order this year. 

In 1994, the IPC issued a total of 421 orders 
— an 11 per cent increase from 1993. (The 
number of orders is less than the number of ap- 
peals closed by order, since an order may deal with 
more than one appeal.) Orders were quite evenly 
divided between provincial and municipal organi- 
zations, with 53 per cent of the 1994 orders con- 
cerning provincial organizations and the remaining 
47 per cent involving municipal organizations. 


Orders Issued — 1988-94 
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A mediated settlement occurred in 59 per cent 
of all appeals resolved this year, an increase from 
54 per cent last year. In appeals closed by order, 
the decision of the head of the government organi- 
zation involved was upheld in 46 per cent of all 
cases, the head’s decision was partly upheld in 31 
per cent of all cases and in 20 per cent of the cases 
the head’s decision was not upheld. In the remain- 
ing three per cent of cases, some other action was 
ordered (e.g., conduct a search, reconsider a deci- 
sion etc.) 


Outcome of Appeals Closed by Order 
Provincial — 1994 


Other 15 (6.1%) 


Head's Decision Not 
Upheld 46 (18.7%) 


Head's Decision 
Upheld 105 (42.7%) 


Head's Decision Partly 
Upheld 80 (32.5%) 


Outcome of Appeals Closed by Order 
Municipal — 1994 


Head's Decision Not 
Upheld 50 (22.2%) 


Head's Decision 
Upheld 109 (48.5%) 


Head's Decision Partly 
Upheld 66 (29.3%) 


Outcome of Appeals Closed Other Than by Order 
Provincial — 1994 


Non-jurisdictional 2 (0.4%) 
Abandoned 12 (2.4%) 


Settled 448 (88.7%) Withdrawn 43 (8.5%) 


Outcome of Appeals Closed Other Than by Order 
Municipal — 1994 


Non-jurisdictional 1 (0.2%) 
Abandoned 19 (3.8%) 


Settled 419 (84.7%) Withdrawn 56 (11.3%) 


Highlights of IPC Orders 


In 1994, the orders issued by the IPC dealt with a 
range of novel and significant issues. A few key 
orders are summarized below. 


PRODUCTION OF CLINICAL RECORDS 


A requester asked the Ministry of Health for access 
to records containing the personal information of a 
patient detained in a psychiatric hospital as a result 
of having been found not guilty by reason of 
insanity, on the charge of attempted murder. The 
Ministry claimed the records in question were 
clinical records and, hence, not subject to the Act. 

The requester appealed. The Ministry was 
asked to deliver a copy of the records in dispute to 
the IPC, but did not do so. The Ministry argued 
that since the records were clinical records, they 
were not accessible under the Act and therefore did 
not need to be supplied. 

The IPC ordered the Ministry to produce all 
records responding to the request. We found that 
while the Legislature clearly intended clinical 
records to fall outside the purview of the Act, it did 
not intend to have the Ministry itself decide the 
threshold issue of whether or not records were 


clinical records. (Order P-623°) 


ACCESS TO LEGAL ACCOUNTS 


A farming couple who had obtained a bank loan 
guaranteed by the Ministry of Agriculture and 
Food were sued for non-payment, and settled out 
of court. The couple then filed a request under the 
Act for information about the costs incurred to 
collect the money owed. The Ministry denied 
access to those records containing legal accounts, 
claiming that they were exempt from disclosure 
because of solicitor-client privilege. The couple 
appealed. 

Based on an earlier order (M-213), the IPC 
concluded that in practice a legal account will fall 


This order was under judicial review at the time of writing. 


RESOLVING APPEALS 


within solicitor-client privilege only when it 
discloses the subject the law firm was asked to 
examine, the strategy used to address the issues 
raised, the particulars of any legal advice provided 
or the outcome of the investigation. 

The IPC ordered the release of the legal ac- 
counts, except for portions of the narratives which 
appeared in some of the records. The implication 
of this case is that legal accounts will not ordinarily 
fall within solicitor-client privilege for purposes of 
the Act, and therefore the costs of the legal services 
to which such accounts refer will be subject to 


disclosure. (Order P-624) 


AUDIT REPORT 
ON RESIDENTIAL FACILITY 


A newspaper reporter sought access to an audit 
report prepared by the Ministry of the Solicitor 
General and Correctional Services on the opera- 
tions of a residence for young offenders. The 
facility was publicly funded through the Ministry. 
The director of the residence objected to the release 
of the report, claiming that its contents in their 
entirety constituted his personal information. The 
reporter appealed. 

The IPC addressed two issues. First, we found 
that the records that contained information about 
an evaluation of an employee’s performance or an 
investigation of an employee’s conduct constituted 
personal information. 

Second, we applied the section of the Act which 
balances privacy interests against the need for 
public scrutiny of government activities. The IPC 
concluded that the release of the information 
would be desirable to subject the monitoring and 
audit functions of the Ministry to public scrutiny. 
The question of a government organization's 
ability to oversee the programs it administers is an 
important public policy issue. 

In balancing the desirability of disclosure with 
the privacy of sensitive personal information, the 
IPC found that the scales in this case tipped in 
favour of disclosure. (Order P-721) 
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DRAFT REGULATION 
RELEASEDESEVEC IV ER 


The Ministry of Finance circulated a draft version 
of a regulation being developed under the Pension 
Benefits Act to 12 interested stakeholders in the 
pension and actuarial community. The purpose of 
the regulation was to allow some large pension 
funds to opt out of certain funding obligations. 
The stakeholders provided written comments that 
were taken into account in preparing the final 
version of the regulation. 

When a requester sought access to the draft 
version, the Ministry refused, applying the Cabinet 
records exemption. On appeal, the IPC referred to 
the section of the Act that provides for release of 
Cabinet records if Cabinet consents. We felt that 
in the circumstances of this case, in which the 
records had already been circulated on a selective 
basis, the Ministry should seek Cabinet approval to 
disclose the draft regulation to the requester. The 
Ministry sought and received Cabinet consent and 


released the records. (Order P-771°) 


FEE WAIVERSEOR 
PATIENT COMPLAINT RECORDS 


A requester representing a group of psychiatric 
patients asked the Ministry of Health for copies of 
records concerning complaints by current or 
former patients of alleged physical or sexual abuse 
by staff of the Queen Street Mental Health Centre. 
The Ministry provided a fee estimate of $147 and 
refused to waive it. 

On appeal, the requester indicated that the 
patients’ group planned to publish the informa- 
tion, and that this would benefit public health or 
safety. Hence this situation met the criteria for a 
fee waiver under the Act. 

The IPC affirmed that the care of institutional- 
ized psychiatric patients is a public responsibility, 
and agreed that dissemination of the information 
would yield a public benefit by disclosing a public 
health and safety concern. The Ministry was 
ordered to waive the fee. (Order P-754) 


This order was under judicial review at the time of writing. 


CLIENT RECORDS HELD BY LAW FIRM 


A requester sought records from a village govern- 
ment that were in the custody of its external 
solicitor. The village claimed that since it did not 
have custody or control of the records, the Act did 
not apply. The solicitor stated that the law firm 
had an established policy that all client records 
were the property of the firm. 

The IPC ruled that it was the law, not the 
firm’s policy, that determined ownership of the 
records. Since the village and the solicitor had 
failed to provide the records or a description to the 
IPC, the IPC ordered the village to review the 
records to determine which ones were under its 
control, according to established legal criteria set 
out in the order. Once this had been done, the 
village would be required to make an access deci- 


sion. (Order M-371) 


Mediation Success Stories 


The majority of appeals are settled through 
mediation. Here are a few examples of successful 
mediation efforts in 1994. 


WITNESSES CONSENT 
TO BE CONTACTED 


The parents of an individual who had died sud- 
denly requested a copy of the police report on the 
circumstances of his death. The police force, while 
sympathetic to the requesters, denied access since 
the report had been compiled as part of a law 
enforcement investigation. 

An appeal was filed, and during mediation the 
IPC Appeals Officer proposed asking the witnesses 
to the incident if they would allow their names and 
phone numbers to be given to the requesters. The 
requesters could then speak directly to the wit- 
nesses to their son’s death. The police were recep- 
tive to the idea, and when contacted, two of the 
three witnesses consented. As a result, the case was 
settled. 


MEMBERSHIP LIST REVISED 


An association of individuals who leased land 
within a provincial park requested the Ministry of 
Natural Resources to verify its membership list. 
While the Ministry had agreed to such requests in 
the past, on this occasion it refused on the ground 
that the information sought was personal informa- 
tion. 

During mediation the IPC suggested including 
a release form in the association’s newsletter. By 
completing the form, each member could author- 
ize the Ministry to disclose his or her personal 
information to the association. This authorization 
would enable the Ministry to update the member- 
ship list in the future. On this basis the appeal was 
settled. 


Judicial Review Update 


Orders issued by the Information and Privacy 
Commissioner may be reviewed by the courts on 
jurisdictional grounds, as may the decisions of 
other administrative tribunals. 

At the end of 1993, 33 applications for judicial 
review were pending. During 1994, 25 new 
applications were filed and 27 cases were resolved. 
This left 31 judicial review applications outstand- 
ing at year end. Of the cases still before the courts, 
25 were launched by government organizations, 


five by affected parties and one by the IPC. 


Outstanding Judicial Reviews — 1994 


Launched by 

IPC 1 
Affected Parties 5 
Institutions 25 
Total 31 


RESOLVING APPEALS 


FUNDING FOR 
MUNICIPAL CORRUPTION SQUAD 


In one case decided this year, a newspaper reporter 
sought records concerning the Ministry of the 
Attorney General’s funding of Project 80, a muni- 
cipal corruption squad with officers from the 
Metropolitan Toronto and York Region police 
forces and the Ontario Provincial Police. The 
Ministry refused to disclose the records on the basis 
of the law enforcement exemption. The reporter 
appealed. 

On appeal, the IPC found that some portions 
of the records were not relevant to the request, and 
so would not be considered in the appeal. The IPC 
went on to order the Ministry to release certain 
portions of the records, while upholding the 
Ministry’s decision on the balance of the informa- 
tion. Both the Ministry and the appellant applied 
for judicial review. 

The Divisional Court dismissed the Ministry’s 
application’, finding that the IPC’s decision on the 
law enforcement exemption was reasonable in light 
of the material before it. The Court pointed out 
that the request was for “financial information 
only” and that the Ministry had offered very 
limited representations and evidence to support the 
exemption. 

Contrary to the appellant’s position, the Court 
found that the IPC must have jurisdiction to 
consider whether information is relevant to a 
request. However, the Court also ruled that under 
the Act the IPC is required to grant the parties to 
the appeal the opportunity to make recommenda- 
tions on the issue of relevancy, an opportunity that 
had not been afforded in this case. 

Accordingly, the portion of the order dealing 
with relevancy was sent back to the IPC to be 
redetermined with the benefit of representations 
from the parties. This was pending at the end of 


1994. 


> Ontario (Attorney General) v. Fineberg (1994), 19 O.R. (3d) 197, 25 Admin. L.R. (2d) 123 (Div. Cr.) 
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Both the Ministry and the appellant applied to 
the Court of Appeal for leave to appeal the deci- 
sion. Both applications were denied. 


MUNICIPAL OFFICIAL’S 
EMPLOYMENT CONTRACT 


Another case this year concerned the employment 
contract of a senior municipal official. The munici- 
pality denied access on the basis of the personal 
privacy exemption. 

On appeal, the IPC found that some portions 
of the record did not constitute personal informa- 
tion and therefore should be disclosed. Further- 
more, the IPC found that most of the remainder of 
the record, though constituting personal informa- 
tion, did not fit within the personal privacy exemp- 
tion and also should be disclosed. However, the 
IPC did uphold the municipality’s decision not to 
release certain information about the affected 
person’s salary. The municipality sought judicial 
review, challenging both the fairness of the IPC’s 
procedures and the substance of the decision. 

The Divisional Court found? that the process 
in this case was not unfair. In reviewing the appeal 
process, the Court recognized the IPC’s obligation 
to maintain confidentiality. Given this obligation, 
the Court stated that, subject to an overriding 
concern for procedural fairness, it should accord 
“curial deference” to the IPC’s procedures. The 
Court also held that the IPC had acted reasonably 
in interpreting and applying the Act. Accordingly, 
the application was dismissed. 


6 Gravenhurst (Town) v. Ontario (Information and Privacy Commissioner), [1994] O.J. No. 2782 (Div. Ct.) 


ENSURING COMPLIANCE WITH 


The Acts establish rules for the collection, reten- 
tion, use, disclosure, security and disposal of 
personal information held by government organi- 
zations. Individuals who believe a government 
organization has failed to comply with the Acts may 
complain to the IPC. The IPC investigates the 
complaint, tries to mediate a solution and, depend- 
ing on the findings, may make recommendations 
to the organization to revise its practices. 

A few IPC investigations arise from appeals. 
That is, the IPC may decide to study an organiza- 
tion’s procedures if problems come to light during 
an appeal proceeding. , 

The IPC also ensures that certain targeted 
government organizations adhere to the legislation 
by conducting compliance reviews, which examine 
the organizations’ information management 
practices. In addition, the IPC sometimes com- 
ments on specific problems or circumstances 
outside the context of an investigation or review. 

As well, the IPC reviews and comments on the 
privacy considerations of computer matching 
proposals submitted by provincial government 
organizations. 


PRIVACY CODE 


Complaints Handled Efficiently 


The IPC completed 212 investigations in 1994, a 
level virtually unchanged from 1993. The IPC 
found a breach of the legislation in nearly three out 
of 10 complaints investigated, again virtually the 
same as last year. 


Number of Privacy Investigations Completed 
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* includes 9 provincial investigations in 1993 and 11 in 1994 
that were discovered to involve non-jurisdictional organizations 
or issues during the course of the investigation 


1993 Privacy 

Complaints 
Carried Forward 20 34 
Initiated HAT 81 
Completed 115* 100 
In Process 32 15 


Municipal numbers appear in bold 


* includes 9 provincial investigations in 1993 and 11 investigations in 1994 that were discovered to involve non- 
jurisdictional organizations or issues during the course of the investigation 


Summary of Privacy Investigations — 1994 


1993 1994 Privacy 1994 
Total Complaints Total 
54 32 15 47 
208 12471792 215 
215 126* 86 212 
47 29 21 50 
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Privacy Investigations Completed This year, a formal report was issued in only 

by Outcome — 1994 one in five cases, and more than two-thirds of 
complaints were settled voluntarily. The average 
time to complete an investigation launched in 
1994 was only 1.9 months, maintaining the level 
achieved in 1993, compared with 5.8 months in 
1992.’ As of December 1994, only 10 per cent of 
complaints in the system were more than four 
months old. 

About six in 10 investigations completed this 
year concerned the disclosure of personal informa- 
tion. The next most frequent issue was collection 
of personal information, which accounted for one 
in four investigations. 


Provincial Municipal 
Breached orne 
the Act Wi e Ac : 4 A 
Privacy Investigations Completed by Issue 
Not Unable to A | 4 
Personal Conclude Provincial — 199 


Information 


Personal Information ; 9 
Bank 1 (0.8%) Security 2 (1.6%) 


Use 2 (1.6%) 


Retention 3 (2.4%) 
A 2 - Access 5 (4.0%) 
Privacy Investigations Completed 


by Type of Resolution — 1994 


Disclosure 74 (58.7%) Collection 39 (30.9%) 


100 


Privacy Investigations Completed by Issue 
Municipal — 1994 


Retention 3 (3.5%) 
Use 4 (4.7%) 

Access 6 (7.0%) 
Collection 15 (17.4%) 


20 Disclosure 58 (67.4%) 


Provincial Municipal 


Mediated/ Abandoned/ 


Report Settled* Withdrawn 


The IPC attempts to resolve privacy complaints As in 1993, one-quarter of complaints investi- 
without a formal report by encouraging mediation gated in 1994 were filed by an employee of the 
and voluntary settlement. This approach has led to government organization involved. 
significant resource savings and better customer 
service. 


* includes 11 provincial investigations that were discovered to involve non-jurisdictional organizations or issues during the course of the investigation 


7 The corresponding median time to complete an investigation launched in 1994 was 1.1 months — maintaining the level achieved in 1993. 


Types of Complainants Involved in 
Privacy Investigations — 1994 
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* includes 11 provincial investigations that were discovered to 


involve non-jurisdictional organizations or issues during the 
course of the investigation 


ORAL COMPLAINTS RISE SHARPLY 


In addition to investigating written complaints, 
the IPC also responds to privacy concerns or 
complaints communicated over the telephone. In 
1994, the IPC resolved 288 oral privacy com- 
plaints, up 77 per cent from the 1993 level. The 
increase could indicate that more people are 
seeking quick, on-the-spot solutions as an alterna- 
tive to formal procedures. In a number of cases the 
IPC contacted the government organization 
involved and brought the matter to their attention. 

In all, combining written and oral totals, the 
IPC resolved 500 complaints in 1994. 


IPC Investigation Highlights 


Here are brief summaries of some of the major 
investigation reports issued by the IPC in response 
to privacy complaints received during 1994. 


ADMINISTRATION OF SICK LEAVE 


A separate school teacher on sick leave was re- 
P 
quired to sign two forms before she could return 
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to work — one authorizing the school board to 
collect a broad spectrum of her medical informa- 
tion from her physician; and another authorizing 
the board’s physician to disclose the teacher’s 
medical information to the board’s assistant super- 
intendent of personnel services. 

The teacher signed the second form as it was, 
but revised the first to consent only to the collec- 
tion of medical information relating to the specific 
reasons for her sick leave. The board accepted the 
revised form. The teacher complained that both 
forms were privacy-invasive and had been signed 
under coercion. 

The IPC found that the collection of informa- 
tion relating to the reasons for the sick leave was 
necessary to the lawfully authorized activity of 
administering employee benefits. However, collec- 
tion of a broad spectrum of health information, as 
proposed in the original form, was not necessary 
and would therefore have contravened the Act. 

The IPC found that the indirect collection of 
the complainant’s medical information from her 
physician was in technical compliance with the Act 
since she had given her consent. However, the IPC 
questioned how voluntary this consent had been 
since the complainant had been told she could not 
return to work unless she signed the form. 

In addition, we found that the disclosure of the 
teacher’s personal information by the board’s 
physician to the assistant superintendent was in 
compliance with the Act. The information had 
been collected for the purpose of determining if the 
teacher was fit to return to work, and was disclosed 
for the intended purpose. 

We recommended that the board amend its 
policies and practices in two ways: 


+ Employees should be permitted to obtain their 
medical information from their physicians and 
submit it directly to the board’s physician them- 
selves. This would eliminate the need for any 
indirect collection and the related consent form. 


¢ Employees should be allowed to review and 
comment on the board physician’s report before it 
is sent to personnel services, so they can object to 
the disclosure of any information they feel is 
irrelevant. (Investigation 194-001M) 
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HIV STATUS 
DISCLOSED UNNECESSARILY 


A complainant was diagnosed as HIV-positive and 
advised by his doctor to get more help to care for 
his mother, who had suffered a stroke. The local 
municipality already provided some in-home sup- 
port through a contract with a private company. 

When the municipality denied the request for 
more help, the complainant decided to reveal his 
HIV status to the municipality. He was assured the 
information would not be passed on to the home 
care company without his consent. Later, however, 
he learned that the company had been informed of 
his condition by the municipality. He complained 
to the IPC that his privacy had been violated. 

The municipality believed that there was a 
compelling health or safety reason for the disclo- 
sure, namely, to enable the home care company to 
take steps to protect its workers. The IPC, how- 
ever, found that the company had no need to 
know the complainant’s HIV status, since it already 
had a policy of using “universal precautions” as its 
standard procedure. Furthermore, the workers were 
caring not for the complainant, but for his mother. 

The IPC recommended that the municipality 
include an explanation of the requirements of the 
Act regarding the disclosure of personal informa- 
tion in its staff training. (Investigation 194-042M) 


WELEARESRECIPIENT Ss: 
PRIVACY VIOLATED 


The complainant, a social assistance recipient, 
represented by a legal clinic, was involved in 
judicial review proceedings in Divisional Court 
with a city’s social services administrator and the 
Social Assistance Review Board (SARB). Acting for 
the complainant, the legal clinic complained that 
the city had disclosed the names of 11 other 
welfare recipients to the city’s solicitor, the com- 
plainant and others. 

The IPC found that the disclosures fit none of 
the circumstances where the release of personal 
information is permitted under the Act. The city 


acknowledged the disclosure and indicated it had 


taken steps to prevent similar incidents in the 
future. For example, it had advised the city admin- 
istrator and solicitor of the breach of privacy, and 
distributed a copy of city policy on access to 
personal information to staff. 

A second issue involved the complainant's 
concern that the solicitor intended to disclose 
personal information contained in a “request to 
admit” as evidence in the court proceeding at a 
later date. The solicitor had served the complainant 
and other interested parties with the “request to 
admit” which included information such as the 
names of the complaint and the 11 other social 
assistance recipients, SARB files numbers, dates of 
appeals, amounts of benefits and other data. 

To prevent further disclosure in this case, the 
IPC contacted the city and suggested there might 
be alternatives to naming the 11 welfare recipients 
who were not parties to the court proceedings. The 
city acted quickly to substitute a revised version of 
the “request to admit” which did not list the wel- 
fare recipients by name. (Investigation 194-056M) 


BIRTH REGISTRATION FORM 
CONFUSING 


The complainant had been adopted at an early age 
and her surname had been officially changed to 
that of her adoptive parents. When she later had a 
child herself, she completed the required Statement 
of Live Birth. This form asked for the mother’s 
surname at birth, but did not indicate that in the 
case of an adopted person, the surname being 
requested was the adoptive name. The complainant 
therefore listed her pre-adoptive name, which was 
keyed into the Ministry of Consumer and Com- 
mercial Relations’ registration database as her 
maiden name. 

Later, the complainant’s husband applied to the 
Ministry for an extended birth certificate for the 
child, and gave the clerk his wife’s maiden name, 
that is, her adoptive name. Without asking for 
identification, the clerk informed the husband that 
the maiden name listed on the birth registration 
was different, and told him what it was. 


The complainant was concerned that her pre- 
adoptive name had been released without proper 
identification. She was also concerned about the 
accuracy of the Ministry’s records, which listed her 
pre-adoptive name as her maiden name. 

The IPC was unable to determine what, if any, 
security precautions the Ministry had taken prior 
to releasing the complainant’s personal information 
to her husband. We noted that while the Ministry 
had defined and put in place reasonable procedures 
to prevent unauthorized access to records, those 
measures had not been documented as required by 
the regulations under the Act. We recommended 
that the Ministry correct this. 

The Ministry was aware of the problem with 
the wording on the form. However, since the form 
was prescribed by legislation, changes would have 
to await the planned reform of the birth registra- 
tion process. In the meantime, the next time the 
form was reprinted, the Ministry would include 
instructions on the back that adopted persons 
should give their adoptive name as their surname at 


birth. (Investigation 193-076P) 


INFORMATION ON 
DAY CARE OPERATION 


A day care operator entering into a purchase of 
service agreement with a municipality filed a 
complaint. He was required to complete a budget 
submission containing information about himself 
and his staff, including their projected salaries. He 
felt that the collection of this information was 
contrary to the Act. 

The operator was also applying to the munici- 
pality for an exemption so he could employ an 
individual who did not meet the qualifications 
under the relevant legislation. The municipality 
requested supplementary documents to support the 
exemption, and again the operator was concerned 
that the collection of some of this information was 
contrary to the Act. 

The IPC found that the collection of a detailed 
budget including the positions and projected 
salaries of staff was necessary to the proper admin- 
istration of lawfully authorized activities — 
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namely, purchasing day care services and determin- 
ing the expenditures needed for this purpose. 

The IPC also found that the collection of 
supplementary information on the exemption 
request was necessary to provide day care services. 
The municipality had an obligation to ensure that 
the individual’s qualifications met its operating 
standards. (Investigation 193-079M) 


Following Up on Recommendations 


An investigation report often contains recommen- 
dations to the government organization involved in 
a complaint for achieving compliance with the Act. 
Each year, the IPC follows up to ensure that its 
recommendations have been carried out. In 1994, 
the IPC followed up on 60 recommendations and 
is pleased to report that a// had been implemented 
to its satisfaction. 


Personal Information 


Collected Indirectly 


Under the legislation, the Commissioner has the 
power in appropriate circumstances to authorize 
the indirect collection of personal information, 
that is, collection “otherwise than directly from the 
individual.” 

In 1994, the IPC processed nine applications 
for indirect collection and approved eight of them. 
Four of the approved applications pertained to 
Workplace Harassment Prevention Programs. 


IPC Reviews 
Computer Matching Assessment 


Computer matching refers to a computerized 
comparison of two or more databases of personal 
information originally collected for different 
purposes. The computer match creates or merges 
files on identifiable individuals to reveal matters of 
interest. 
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Computer matching by government organiza- 
tions is intended to improve the efficiency of 
programs and services. This objective must be 
weighed against the dangers to privacy. To provide 
guidance on balancing these priorities in 1994, 
Management Board Secretariat (MBS) issued a 
directive, “Enhancing Privacy: Computer Match- 
ing of Personal Information.” 


Data Sharing 


This year the Ministry of Community and Social 
Services asked the IPC to examine two proposed 
data sharing agreements, one with the province of 
Quebec and the other with the federal Unemploy- 
ment Insurance Commission (UIC). The agree- 
ments were intended to permit the sharing of 
personal information in an effort to reduce fraud in 
the social assistance system. 

Among several privacy concerns, the IPC urged 
that an individual be given a chance to refute 
information obtained from UIC before adverse 
action is taken on social assistance. The IPC also 
noted that the Quebec agreement contained no 
termination date or process for evaluating the 
effectiveness of the data sharing. 


The directive requires provincial government 
organizations planning a computer match to take 
certain steps to protect the privacy interests of 
individuals. One of these steps is to prepare a 
computer matching assessment, and provide the 
IPC with a copy of the assessment 45 days before 
the matching activity is to start. Both the assess- 
ment and the IPC’s comments become public 
documents. 

In 1994, the IPC received and commented on 
the first computer matching assessment — from 
the Ministry of Health, which proposed a compu- 
ter match with the Quebec Ministry of Health to Government Actions 
identify individuals potentially registered as eligible Under Scrutiny 
for health insurance in both provinces. These 
individuals will likely be contacted to ensure they 


are receiving be : 
Ss veusiissel vam ave omnes wine: tions of government actions and conducts reviews 


they reside. If fraud is suspected, appropriate of government activity to ensure compliance with 
follow-up action will be taken. Heer hee 


The IPC examined the computer matching 
assessment and made three recommendations: 


The IPC offers comment on the privacy implica- 


° The Ministry should update its directory of WRONG FAX NUMBER 

records to list a new databank of individuals 

registered for health insurance in both Ontario Upon learning that a municipal police force had 
and Quebec. inadvertently faxed details of a murder investiga- 


tion to an incorrect fax number, the IPC visited 
the force to review its fax procedures. We found 
that in the incident in question, the auto-dialing 
feature of the fax machine had been used. This 
feature involves entering phone numbers into the 
machine’s memory for automatic dialing at the 
touch of a button. 

Following the IPC’s visit, the police force 
disabled the auto-dialing feature on all fax equip- 
ment and advised staff that personal information 
+ The assessment did not indicate the start date of should rarely be faxed; courier or mail was prefer- 
the matching activity; this should be included in all able. 


assessments if at all possible. 


¢ The business case for the computer match should 
provide more detail about the estimated costs of 
the matching activity. For example, the cost of 
verifying the information generated by a match 
should be broken down and an explanation pro- 
vided of how the figures were reached. Without 
more detailed estimates, it will be extremely diffi- 
cult to determine the true costs and benefits of the 
match at a later date. 


VERIFYING SOCIAL ASSISTANCE 
PEIGIB LE UY 


The Ministry of Community and Social Services 
introduced an Enhanced Verification Policy 
requiring sole-support parents receiving social 
assistance to verify their child’s school attendance 
by having the school complete a form. The IPC 
met with Ministry staff and learned that this policy 
had always existed regarding children aged 16 and 
17, but had been expanded to include all children. 
We expressed misgivings about requiring 
parents to disclose to the school the fact that they 
were on social assistance. The Ministry acknowl- 
edged our concerns and decided not to expand the 
policy, keeping it only for 16 and 17 year-olds. 
Alternative proof of school attendance, such as the 
attendance record on a report card, will be accept- 


able for children under 16. 


ORDERS SPARK REVIEWS 


As a result of an IPC order resolving an appeal, the 
IPC undertook a review of a municipality’s han- 
dling of job competition records. The IPC found 
that since the municipality did not have a formally 
documented job competition process, records were 
not being created and retained for the period 
required by the legislation. The IPC also noted 
that two types of records from the job competition 
process were not listed in the municipal by-law 
covering record retention. 

Another order led to a review of disclosure 
practices at the Criminal Injuries Compensation 
Board, which had improperly disclosed a third 
party’s personal information to a requester. The 
IPC gave the board six months to supply proof that 
it had reviewed its disclosure procedures and 
developed and implemented improvements to 
prevent similar occurrences. 


ENSURING COMPLIANCE WITH PRIVACY CODE 
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Access and privacy concerns extend far beyond the 
public sector, and involve a wider social and 
economic debate. Part of the IPC’s job is to con- 
duct research and use the results to advance public 
discussion and recommend changes in legislation 
and government policy. The IPC also analyzes the 
practical challenges government organizations face 
in complying with the Aczs, and advises on ways to 
improve their data protection and information 
management practices. 


Rules of the Road 
for the Information Highway 


The telephone, television and computer are con- 
verging rapidly, bringing closer the day when 
voice, video and data signals will be accessed 
through a single plug in the wall. The vast network 
of networks that enables multimedia communica- 
tion has been referred to as the information high- 
way, and its emergence generates a host of access 
and privacy implications. 

Anticipating the need for some “rules of the 
road,” the IPC developed a set of access and 
privacy principles for the information highway and 
submitted these principles to the Canadian Radio- 
television and Telecommunications Commission 
(CRTC) in response to a call for comments on 
information highway policy issues. 

The IPC’s views also appeared in a consultation 
paper produced by the Coalition for Public Infor- 
mation, a group of some 350 libraries, publishers, 
universities and other concerned parties. In addi- 
tion, the privacy principles formed the basis for the 
IPC’s response to Industry Canada’s discussion 
paper, Privacy and the Canadian Information 
Highway. 

The key ideas which underlie these principles 
include the following: 


* Universal access should be the defining character- 
istic of the information highway, just as this value 


has shaped our traditional communications sys- 

tems. Everyone should have access to the informa- 
tion highway — without regard to such factors as 
income, location, language, disability or technical 


know-how. 


¢ The right to personal privacy should be explicitly 
recognized by those who build, operate and use the 
information highway. This is fundamental to the 
viability of the highway itself — for if people 
doubt their privacy is secure when they use elec- 
tronic networks, they may avoid using them. 


¢ The impact on access and privacy should be 
weighed before any new information technology or 
service is introduced. Access and privacy features 
must be built into new systems at the design stage, 
not treated as an afterthought. Otherwise, damage 
to these traditional values of access and privacy 
may not become visible until it is too late or too 
costly for repair. 


¢ Public education and training must be provided 
to make people aware of new information services 
and how to use them, and to alert users to poten- 
tial privacy threats and how to avoid them. 


+ While many services on the information highway 
will be supplied on a commercial basis, access must 
be guaranteed to services of public value — such as 
educational programs or links between government 


and the public. 


¢ The information highway should be covered by 
the internationally recognized code of fair informa- 
tion practices. Ontario’s existing privacy legislation 
for provincial and municipal government organiza- 
tions is based on these international standards 
concerning the collection, retention, use, disclosure 
and security of personal information. 


¢ The information highway, at least initially, 
should not totally replace traditional means of 
communication. Not everyone is on-line, and non- 
electronic services should continue until demand 
for them disappears. 


¢ Those who find privacy losses unacceptable 
should not be forced to accept them. Where new 
information technologies alter the privacy status 
quo, users should be able to preserve their existing 
levels of privacy at no extra cost. 


¢ Violation of privacy should have consequences 
for the violator. A system should be established for 
handling complaints, imposing penalties and 
awarding damages for improper uses of personal 
information. 


Sounding the Alarm 
on Electronic ID 


As we go through the routine of daily life in our 
information society, each one of us leaves a data 
trail, such as records of telephone calls, bill pay- 
ments, health services or insurance claims. One 
barrier preventing this information from becoming 
a tool of control is the fact that our personal data is 
currently stored using different methods of identi- 
fication. 

We have different IDs for different purposes — 
a health card number, a driver’s licence number, a 
Social Insurance Number, bank numbers and so 
forth.. However, if each of us had one unique all- 
purpose number, every transaction an individual 
made could be linked across hundreds of databases. 
Comprehensive profiles could be created at the 
push of a button. This year the IPC released a 
report on this critical issue, called Privacy and 
Electronic Identification in the Information Age. 

All three levels of government — in their search 
for perceived efficiency increases, better customer 
service and reduction of fraud — have shown 
interest in new identification schemes, some 
featuring multi-purpose cards. The IPC fears that 
once a multi-purpose card based on a single identi- 
fying number has been developed for a few defined 
functions, the momentum to expand it to other 
uses could prove irreversible. 

The electronic ID paper reasserts the IPC view 
that properly designed information systems can 
enhance privacy rather than undermine it. The key 
is to insist that the experts who develop and 
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manage systems find ways to make them compat- 
ible with privacy values beginning at the design 
stage. For example, the IPC cites “blind digital 
signatures” based on recent advances in encryption 
systems, as a way to verify a person’s right to make 
a transaction, without revealing his or her identity. 

In addition to publishing the paper, the IPC 
responded directly to provincial and municipal 
proposals and statements concerning new identifi- 
cation schemes for health care and welfare services 
and drivers’ licences. The IPC remains convinced 
that the move toward centralized databases con- 
taining photos, signatures, fingerprints or DNA 
profiles — accompanied by a unique identifying 
number — is unnecessary and open to abuse. It 
paves the way for a surveillance society, however 
unintended. 


Privacy in the Marketplace 


Though Ontario’s privacy legislation covers only 
government organizations, today’s privacy issues 
know no such boundaries. During 1994 the IPC 
released two companion publications to guide 
consumers and businesses in the private sector: 
Privacy Alert: A Consumer Guide to Privacy in the 
Marketplace and Privacy Protection Makes Good 
Business Sense. 

Privacy Alert serves as a privacy awareness 
primer for consumers. It points out that consumers 
themselves often unwittingly contribute to their 
own loss of privacy by giving out their personal 
information — telephone number, address, occu- 
pation, income, age — that is not necessary for the 
transaction at hand. 

The publication urges consumers to be in- 
formed about privacy issues, and provides a series 
of 18 tips on how to do it. It calls on consumers to 
take back control of their own information by 
being aware, exercising caution and asking ques- 
tions about what happens to the information they 
are providing. 

If consumers are increasingly worried about 
privacy — as polls indicate they are — it simply 
makes good business sense for market-driven 
companies to build privacy protection into their 
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routine operating procedures. The IPC business 
paper underlines that privacy protection is not in 
conflict with legitimate business needs to collect 
and use information. However, businesses must be 
sensitive to their customers’ privacy. 

In the paper, the IPC offers a series of best 
practices to foster this sensitivity. If customers 
understand why they are being asked to provide 
personal information, what will be done with it, 
and how they can express concerns, business will 
build customer loyalty. 


Electronic Phone Book 
Problematic 


When the CRTC invited comments on the 
possibility of providing the information in tel- 
ephone directories in an electronic format, the IPC 
responded by raising two major concerns. 

First, the IPC felt the sale or lease of customer 
information by telephone companies to third 
parties, without the consent of the individuals 
affected, would be inconsistent with fair informa- 
tion practices. Second, providing residential listing 
information in an electronic format has much 
more potential for abuse than does the current 
printed format. Once converted to electronic form, 
the data can be readily sorted and combined with 
other information and used for purposes such as 
telemarketing, which were not anticipated by the 
individuals who provided the information. 

The IPC recommended that, if the CRTC 
decides to approve the proposal, the telephone 
companies involved should be required to: 


° obtain the consent of the individuals to whom 
the information relates by having them explicitly 
opt in; 


° include in contracts with third parties a require- 
ment to use the information only for the purposes 
to which the individuals have consented; and 


* inform the public about the privacy implications 
of releasing residential listing information to third 
parties in an electronic format. 


E-Mail Security Measures 


Electronic mail can be an effective tool to promote 
the exchange of ideas and information and increase 
productivity in the workplace. On the other hand, 
it has been observed that e-mail has the same 
security level as a postcard. 

To heighten awareness, the IPC prepared the 
report, Privacy Protection Principles for Electronic 
Mail Systems, which contains guidelines for public 
and private sector organizations to use in develop- 
ing their own customized policies on e-mail. 


Among IPC suggestions: 


° privacy of e-mail should be respected and pro- 
tected; 


* each organization should formulate an explicit 
policy on e-mail privacy, and communicate it to 
users; 


* users should receive training in security and 
privacy issues; 


¢ e-mail should not be used to collect, use or 
disclose personal information without adequate 
safeguards; and 


* organizations should develop security measures to 
protect the confidentiality of messages. 


Fostering Open Government 


Meeting the public’s growing demand for informa- 
tion in a cost-effective manner is a continuing 
challenge for government organizations. To help 
meet this challenge, the IPC and Management 


Board Secretariat this year released the paper, 


Routine Disclosure and Active Dissemination (RD/AD). 

Routine disclosure occurs when a government 
organization automatically releases specific admin- 
istrative and operational records in response to a 
request, either within or outside the formal access 
process. Active dissemination takes place when a 
government organization anticipates customer 
needs by periodically releasing useful general 
records without a request. 


The paper presents a series of practices to help 
government organizations determine which records 
could be routinely disclosed or actively dissemi- 
nated. These guidelines were developed with input 
from a working group of municipal and provincial 
government officials. 

Not only do the RD/AD options mean better 
customer service, they can also save valuable 
resources. Offering established access to designated 
types of records is often less time-consuming and 
less costly than processing formal requests and 
appeals under the Acts. These alternatives are 
increasingly attractive in the current climate of 
fiscal restraint. 


Committee Reviews Municipal Act 


In January 1994, the IPC made a major submis- 
sion, containing 53 recommendations, to the 
Standing Committee on the Legislative Assembly, 
as it began the required three-year review of the 
municipal Act. Since the municipal and provincial 
Acts form an integrated scheme, many of the IPC’s 
proposals affected the provincial statute as well. 

Foremost among the recommendations was a 
call to extend access and privacy legislation to 
hospitals, universities, social service agencies and 
professional governing bodies. These organizations 
perform significant public functions, in many cases 
receive substantial public funds, and often hold 
sensitive personal information. 

After considering testimony and submissions 
from more than 55 institutions, groups and indivi- 
duals, the Committee issued its report in Decem- 


ber 1994. 
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COMMUNICATIONS OUTREACH INTENSIFIES 


The IPC has an ongoing public education program 
to raise awareness of access and privacy rights 
under the Acts, inform users of the IPC’s proce- 
dures for dealing with appeals and complaints, and 
sensitize government organizations to their respon- 
sibilities under the legislation. 


Support for 


Government Co-ordinators 


In co-operation with Management Board Secre- 
tariat, during 1994 the IPC participated in 19 
training sessions for Freedom of Information and 
Privacy Co-ordinators in municipal and provincial 
government organizations. The co-ordinators play 
a hands-on role in the day to day operation of the 
access and privacy system. 

In another step to foster the co-ordinators’ 
professional development, the IPC co-sponsored 
the annual fall workshop with Management Board 
Secretariat and the Association of Municipal Clerks 
and Treasurers of Ontario. This year’s event, Fast 
Forward: Access and Privacy Issues in the Information 
Age, attracted more than 250 participants to two 
days of practical sessions featuring expert panels, 
workshops and round table discussions. 


Educating the Public 


In 1994, the IPC outreach efforts included a heavy 
schedule of speaking engagements and extensive 
media relations work. 

Through the IPC Speakers’ Bureau, the 
Commissioner, Assistant Commissioners and staff 
delivered 39 speeches across Ontario and in other 
jurisdictions. Speakers addressed such groups as the 
Canadian Bar Association, the Ontario Medical 
Association, the Canadian Public Relations Soci- 
ety, a seminar at the Kennedy School of Govern- 
ment at Harvard University, the Council on 
Governmental Ethics Laws, journalism classes at 


Ryerson Polytechnic University and a public forum 
at the Burlington Public Library. 

The IPC ran targeted province-wide media 
campaigns — including news releases, feature 
articles, speeches, and other materials — to pro- 
mote four major initiatives: the [PC’s submission 
to the legislative committee reviewing the muni- 
cipal Act; and the release of three IPC reports: 


° Privacy Protection Principles for Electronic Mail 
Systems 


+ Privacy Alert: A Consumer’s Guide to Privacy in the 
Marketplace 


° Privacy Protection Makes Good Business Sense 


In all, the IPC responded to 142 media re- 
quests for further information and arranged 53 
interviews with the Commissioner or IPC staff. 

The IPC continued to distribute publications 
to government organizations covered by the Acts, as 
well as to the wider access and privacy community. 

Perspectives, the IPC newsletter appeared three 
times this year to keep readers informed of IPC 
activities and to flag emerging issues. It has a 
circulation of about 3500 government organiza- 
tions, business groups and interested individuals. 

During 1994, the IPC also published eight 
issues of Practices for government organizations 
and users of the appeal and complaint systems. 
These concise guides offered practical advice on 
such procedural themes as “Increasing the Effec- 
tiveness of Representations,” “Clarifying Access 
Requests,” and “How to Protect Personal Informa- 
tion in the Custody of a Third Party.” 

In addition, three brochures on the IPC and 
pocket guides to the Acts remained popular. In all, 
the IPC provided more than 17 500 information 
pieces in response to requests from government 
organizations and members of the public during 
1994. 

As part of outreach efforts, the IPC also offers 
province-wide information services through a toll- 
free telephone line. During 1994, the IPC responded 


to almost 5000 access and privacy information calls. 


FINANCIAL STATEMENT 


Statement of Expenditure for 1994-95 1993-94 
the year ended March 31, 1995 $ | $ 
Salaries and wages 5,455,615 5,455,199 
Employee benefits 628,500 906,057 
Transportation and communication 111,507 116,919 


Services 934,158 1,121,528 


Supplies and equipment 316,630 477,252 


Total Expenditures 7,446,410 8,076,955 


The figures for the period ending March 31, 1995 are unaudited. For a copy of the Provincial 
Auditor's report please contact the IPC Communications department at 416-326-3952 or 
1-800-387-0073; TTY (Teletypewriter) 416-325-7539. 
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Information and Privacy Commissioner 
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